sealkeep 0.9.0 → 0.11.0

package/dist/site/llms.txt

@@ -0,0 +1,67 @@
+# Sealkeep
+
+> Sealkeep is secure organizational memory for AI-assisted software engineering. It preserves coding-agent sessions as encrypted, searchable company knowledge so authorized developers and agents can continue work after people, machines, or tools change.
+
+Last updated: 2026-09-04
+
+## Primary enterprise value
+
+When a developer leaves or changes teams, Sealkeep keeps the approved engineering context that would otherwise remain trapped in that developer's local coding-agent sessions. This includes decisions, reasoning, commands, test results, failed approaches, handoffs, and implementation history captured in supported sessions.
+
+Sealkeep also lets authorized junior developers and their coding agents retrieve relevant project history created by senior engineers. This is project-scoped context retrieval, not silent model training, and it does not grant access outside the projects approved for that teammate.
+
+## Enterprise use cases
+
+- Developer departure and team changes: retain relevant engineering reasoning when an employee or contractor leaves.
+- Senior-to-junior knowledge continuity: make approved senior engineering decisions and patterns searchable by junior teammates and their agents.
+- Faster onboarding: help new engineers understand why systems were built a certain way without relying only on code and tickets.
+- Engineering handoffs: preserve what was attempted, what changed, which constraints mattered, and where work stopped across teams and time zones.
+- Incident response: search prior investigations, fixes, commands, and decision history while reconstructing an event.
+- Reduced duplicated work: reuse prior research and avoid solving the same engineering problem repeatedly in isolated agent sessions.
+- Shared agent memory: provide project-scoped history to approved Claude Code and Codex agents on authorized machines.
+- Tool and machine continuity: keep relevant history available when a laptop is replaced or a team moves between supported coding agents.
+- Contractor continuity: retain approved project knowledge after an external developer's engagement ends.
+- Security and audit workflows: search preserved evidence locally, review Sealkeep activity, and scan transcripts for likely credentials before sealing.
+
+## How Sealkeep works
+
+Sealkeep archives raw coding-agent session bytes, encrypts them on the developer's machine, verifies durable storage, and can restore the original native session layout. Metadata and full-text search run locally. A local MCP server allows supported coding agents to search approved history and prepare relevant context.
+
+Team memory is scoped to a project. Each authorized member receives an individually wrapped project key that can be revoked. Recalled historical text is labeled as untrusted context, and current facts should be checked against the repository.
+
+## Security and deployment
+
+- Plaintext session content and private decryption keys remain on customer endpoints.
+- Storage can be customer-owned or Sealkeep-managed; enterprise deployments can run on-premises or in the customer's cloud.
+- A fully isolated enterprise edition can operate without a mandatory Spala-hosted API, storage, authentication, telemetry, or license-check call.
+- Sealkeep does not claim a completed independent cryptographic audit today.
+- Secret scanning reduces exposure risk but does not guarantee that every secret will be detected.
+
+## Supported interfaces
+
+- Coding agents: Claude Code and Codex.
+- Search: `sealkeep search <query> --content` and `sealkeep_search` through the local MCP server.
+- Restore: `sealkeep recover <id> <destination>` or native restoration to the original session location.
+- Security automation: `sealkeep scan ... --json` and `sealkeep audit --json`.
+- Storage: Amazon S3, Cloudflare R2, Google Cloud Storage, Google Drive, and S3-compatible storage such as MinIO.
+
+## Plans
+
+- Free: $0, using customer-owned storage.
+- Pro Lite: $2 per month, using customer-owned storage with encrypted recovery escrow and multi-machine sign-in.
+- Team: $9 per seat per month for project-scoped access, organizational recovery, and revocation; storage is separate or customer-owned.
+- Managed storage: $6 to $30 per month, depending on capacity.
+- Enterprise and fully isolated deployment: custom agreement.
+
+## Canonical resources
+
+- [Product overview and pricing](https://sealkeep.spala.ai/)
+- [Enterprise use cases and deployment](https://sealkeep.spala.ai/#enterprise)
+- [Public Trust Center and procurement evidence](https://sealkeep.spala.ai/trust.html)
+- [CLI and security interfaces](https://sealkeep.spala.ai/#docs)
+- [Machine-readable product context](https://sealkeep.spala.ai/llms.txt)
+
+## Contact
+
+- Enterprise architecture and security review: security@spala.ai
+- Procurement and legal review: legal@spala.ai

package/dist/site/trust/architecture-data-flow.html

@@ -0,0 +1,53 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep architecture and data flow — Sealkeep Trust Center</title><meta name="description" content="Inspect Architecture &amp; data flow for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/architecture-data-flow.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Architecture &amp; data flow</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html" aria-current="page">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status published">Published</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep architecture and data flow</h1>
+<p class="document-meta"><strong>Status:</strong> Published architecture summary<br><strong>Reviewed:</strong> 2026-09-04<br><strong>Scope:</strong> Sealkeep client, hosted service, and enterprise self-hosted modes</p>
+<h2>Security objective</h2>
+<p>Sealkeep preserves coding-agent session history while keeping archive plaintext and private decryption material at customer endpoints. The service processes ciphertext and the operational metadata required for storage, membership, retrieval, and audit.</p>
+<p>This document describes the intended boundary. It is not an independent audit.</p>
+<h2>Common endpoint flow</h2>
+<pre data-language="text"><code>Claude Code / Codex session
+          |
+          v
+Local Sealkeep adapter and durable queue
+          |
+          v
+Endpoint encryption + locally wrapped archive key
+          |  plaintext ends here
+          v
+Ciphertext + opaque operational metadata
+          |
+          v
+Selected control plane and object storage</code></pre>
+<p>The endpoint performs capture, encryption, local search, decryption, and recovery. The hosted service is not designed to receive a recovery phrase, device private key, plaintext archive key, customer storage credential, or session plaintext.</p>
+<h2>Deployment modes</h2>
+<h3>Hosted or managed</h3>
+<p>Spala operates the account/control-plane service and may arrange encrypted object storage. The endpoint still encrypts session content before upload. Spala processes account, device, entitlement, membership, object-routing, ciphertext, checksum, and audit data needed for the selected service.</p>
+<h3>Connected self-hosted</h3>
+<p>The customer operates the application, PostgreSQL, logs, and object storage. A documented outbound licence-validation path to Spala may remain. Its fields, frequency, retention, and failure behaviour must be approved for the deployment.</p>
+<h3>Fully isolated self-hosted</h3>
+<p>The customer operates the application, PostgreSQL, object storage, identity, logs, backups, region, and network. The deployment uses an offline entitlement and has no mandatory Spala-hosted API, database, object store, authentication, telemetry, or licence request during ordinary operation.</p>
+<pre data-language="text"><code>Customer endpoint
+  plaintext session + customer-held keys
+          |
+          | endpoint encryption
+          v
+Customer-operated Sealkeep service &lt;--&gt; Customer PostgreSQL
+          |
+          | encrypted archive objects
+          v
+Customer-controlled object storage</code></pre>
+<p>Spala may separately retain business-contact, contract, licence-delivery, update, or support data. Support material is received only when the customer elects to disclose it or authorises a time-bounded support path.</p>
+<h2>Data visibility</h2>
+<div class="table-scroll"><table><thead><tr><th>Data</th><th>Hosted/managed</th><th>Fully isolated</th></tr></thead><tbody><tr><td data-label="Data">Coding-agent session plaintext</td><td data-label="Hosted/managed">Not designed to be received by Spala</td><td data-label="Fully isolated">Customer endpoint only</td></tr><tr><td data-label="Data">Recovery phrase and device private keys</td><td data-label="Hosted/managed">Not received by Spala</td><td data-label="Fully isolated">Customer endpoint/approved customer secret facility</td></tr><tr><td data-label="Data">Encrypted archive objects</td><td data-label="Hosted/managed">Spala-selected or customer-selected storage</td><td data-label="Fully isolated">Customer-selected storage</td></tr><tr><td data-label="Data">Account, device, membership, entitlement, audit state</td><td data-label="Hosted/managed">Hosted control plane</td><td data-label="Fully isolated">Customer PostgreSQL</td></tr><tr><td data-label="Data">Customer storage credentials</td><td data-label="Hosted/managed">Endpoint only</td><td data-label="Fully isolated">Customer endpoint/secret facility</td></tr><tr><td data-label="Data">Service logs and backups</td><td data-label="Hosted/managed">Hosted operators for selected service</td><td data-label="Fully isolated">Customer infrastructure</td></tr><tr><td data-label="Data">Contract and security contacts</td><td data-label="Hosted/managed">Spala business systems</td><td data-label="Fully isolated">Spala business systems, separate from runtime</td></tr></tbody></table></div>
+<p>Ciphertext size, timing, identifiers, and operational metadata are not represented as anonymous. Source paths and local search content normally remain at the endpoint.</p>
+<h2>Key custody and access limits</h2>
+<ul><li>Each archive uses a fresh random 256-bit data-encryption key.</li><li>Archive keys are wrapped locally for configured phrase and device recipients.</li><li>Recovery phrases and device private keys are not sent to the service.</li><li>Support cannot decrypt an archive or recover a lost phrase.</li><li>Revoking a device blocks future service operations. It cannot withdraw a copy and</li></ul>
+<p>key already obtained before revocation.</p>
+<ul><li>The current Team model preserves access through remaining accepted project members.</li></ul>
+<p>It does not yet claim a separate organisation recovery recipient or transferable project-owner role.</p>
+<h2>Known assurance limits</h2>
+<ul><li>The cryptographic format uses published authenticated-encryption primitives and</li></ul>
+<p>has deterministic vectors and tamper tests, but has not completed an independent cryptographic audit.</p>
+<ul><li>JavaScript zeroisation is best effort.</li><li>Ciphertext length and timing reveal operational information.</li><li>Fully isolated delivery must pass a customer-observed egress-denied acceptance test.</li></ul>
+<p>Questions: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/audit-roadmap.html

@@ -0,0 +1,37 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep assurance and audit roadmap — Sealkeep Trust Center</title><meta name="description" content="Inspect Audit roadmap for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/audit-roadmap.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Audit roadmap</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html" aria-current="page">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status planned">Roadmap</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep assurance and audit roadmap</h1>
+<p class="document-meta"><strong>Status:</strong> Audit preparation active · Q3 2026<br><strong>Reviewed:</strong> 2026-09-05</p>
+<p>The Q3 2026 assurance workstream packages implemented controls, test evidence, and review scope for independent assessment. Internal evidence is published now; external validation is the next gate.</p>
+<h2>Current evidence</h2>
+<ul><li>Authenticated-encryption format v2 with deterministic vectors and tamper tests.</li><li>Archive round-trip, wrong-key refusal, integrity refusal, and restore tests.</li><li>Upload verification before a local source becomes eligible for reclamation.</li><li>Signed device requests with timestamp and nonce replay protection.</li><li>Tenant/account boundary and destructive-authority tests.</li><li>Project collaboration rehearsal: 12/12 live company scenarios recorded as passing</li></ul>
+<p>on 2026-08-20, covering two developers, a shared project, cross-machine retrieval, revocation, and allowed/refused deletion.</p>
+<ul><li>Architecture, threat-model, deployment, DPA, and TOMs working documentation.</li><li>Dependency lockfile and release checksum/manifest tooling.</li></ul>
+<h2>Q3 2026 — complete procurement evidence</h2>
+<ul><li>Verify every production Subprocessor's legal entity, service, data, locations,</li></ul>
+<p>access regions, retention, transfer mechanism, and Article 28 flow-down terms.</p>
+<ul><li>Verify hosted identity, network, logging, monitoring, backup, restore, incident,</li></ul>
+<p>deletion, and privileged-access evidence.</p>
+<ul><li>Review the DPA, privacy notice, retention, and public-sector terms against the</li></ul>
+<p>selected customer, jurisdiction, and deployment.</p>
+<ul><li>Publish dated versions and a change-notice mechanism.</li></ul>
+<p><strong>Exit evidence:</strong> approved DPA/TOMs annex, contractual Subprocessor register, production data map, restore/deletion rehearsal record, and named control owners.</p>
+<h2>Next assurance gate — independent product security review</h2>
+<ul><li>Commission a third-party cryptographic implementation review.</li><li>Commission external review of key lifecycle, recipient removal, project continuity,</li></ul>
+<p>and organisation recovery design.</p>
+<ul><li>Commission an authenticated application/API penetration test.</li><li>Remediate material findings and publish a scope/methodology/outcome summary that does</li></ul>
+<p>not disclose exploitable detail.</p>
+<p><strong>Exit evidence:</strong> reviewer identity and independence, scope, version, dates, severity summary, remediation status, and any residual accepted risk.</p>
+<h2>Q3–Q4 2026 — software supply-chain evidence</h2>
+<ul><li>Publish a per-release CycloneDX or SPDX SBOM.</li><li>Publish artifact SHA-256 values, source revision, and test summary.</li><li>Operate signed manifests with a published verification key and rotation/revocation</li></ul>
+<p>procedure.</p>
+<ul><li>Add supported platform code-signing/notarisation.</li><li>Evaluate build provenance and reproducibility against an appropriate framework.</li></ul>
+<p><strong>Exit evidence:</strong> buyer-verifiable release bundle tied to the exact delivered artifact.</p>
+<h2>Recurring assurance — after the first independent review</h2>
+<ul><li>Define annual and material-change review cadence.</li><li>Re-run independent testing after material security-boundary changes.</li><li>Exercise incident response, backup restore, customer exit, and no-egress deployment.</li><li>Track coverage health if organisation-enforced capture and fleet evidence become</li></ul>
+<p>part of the product claim.</p>
+<ul><li>Publish changes, expired evidence, residual risk, and next review dates.</li></ul>
+<h2>Claims not made today</h2>
+<ul><li>No independent cryptographic audit completed.</li><li>No SOC 2 or ISO 27001 certification claimed.</li><li>No OS code-signing certificate claimed.</li><li>No public per-release SBOM or complete build attestation claimed.</li><li>No guarantee that every coding-agent session across a company is captured.</li><li>No separate organisation recovery recipient or transferable project-owner role</li></ul>
+<p>claimed in the current Team model.</p>
+<p>Roadmap questions: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/deployment-responsibility.html

@@ -0,0 +1,11 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep deployment responsibility matrix — Sealkeep Trust Center</title><meta name="description" content="Inspect Deployment responsibility matrix for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/deployment-responsibility.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Deployment responsibility matrix</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html" aria-current="page">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status published">Published</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep deployment responsibility matrix</h1>
+<p class="document-meta"><strong>Status:</strong> Published baseline; completed in the customer order form<br><strong>Reviewed:</strong> 2026-09-04</p>
+<p>This matrix describes the default allocation for fully isolated self-hosted operation. Connected self-hosted and hosted services change the operator of selected components; the signed order form remains authoritative.</p>
+<div class="table-scroll"><table><thead><tr><th>Control area</th><th>HM Software LLC / Spala</th><th>Customer</th></tr></thead><tbody><tr><td data-label="Control area">Application delivery</td><td data-label="HM Software LLC / Spala">Deliver the agreed application/backend bundle, schema, deployment instructions, version, and integrity information</td><td data-label="Customer">Validate and accept the delivered version and approved configuration</td></tr><tr><td data-label="Control area">Runtime and network</td><td data-label="HM Software LLC / Spala">State requirements and disclose optional external dependencies</td><td data-label="Customer">Operate container/VM/Kubernetes, ingress, egress, firewall, TLS, DNS, and capacity</td></tr><tr><td data-label="Control area">Database and storage</td><td data-label="HM Software LLC / Spala">Preserve documented data model and encrypted archive interface</td><td data-label="Customer">Operate PostgreSQL, object storage, credentials, regions, availability, and deletion</td></tr><tr><td data-label="Control area">Identity and access</td><td data-label="HM Software LLC / Spala">Supply application access-control capabilities and document roles</td><td data-label="Customer">Configure identity provider, named administrators, MFA, least privilege, and reviews</td></tr><tr><td data-label="Control area">Endpoint encryption</td><td data-label="HM Software LLC / Spala">Maintain the archive format and endpoint cryptographic implementation</td><td data-label="Customer">Secure endpoints, OS accounts, agent files, local keystore, and device custody</td></tr><tr><td data-label="Control area">Recovery and recipients</td><td data-label="HM Software LLC / Spala">Document recipient, rewrap, revocation, and recovery behaviour</td><td data-label="Customer">Hold phrases and private keys; govern project membership and recipient lifecycle</td></tr><tr><td data-label="Control area">Logging and monitoring</td><td data-label="HM Software LLC / Spala">Document security-relevant events produced by the product</td><td data-label="Customer">Collect, protect, retain, review, alert, and respond to deployment logs</td></tr><tr><td data-label="Control area">Backup and recovery</td><td data-label="HM Software LLC / Spala">Provide product restore/export instructions and agreed defect support</td><td data-label="Customer">Back up and restore PostgreSQL, objects, configuration, logs, and customer-held keys</td></tr><tr><td data-label="Control area">Retention and deletion</td><td data-label="HM Software LLC / Spala">Implement documented product controls; delete Spala-controlled support data as agreed</td><td data-label="Customer">Set policy and delete endpoint, database, object, log, snapshot, and backup copies</td></tr><tr><td data-label="Control area">Vulnerability and patches</td><td data-label="HM Software LLC / Spala">Maintain intake, assess product issues, issue supported updates and advisories</td><td data-label="Customer">Monitor notices, test and deploy patches within customer change policy</td></tr><tr><td data-label="Control area">Support access</td><td data-label="HM Software LLC / Spala">No standing access; request only approved minimum; respect time and scope</td><td data-label="Customer">Approve, provision, observe, log, and revoke time-bounded access if needed</td></tr><tr><td data-label="Control area">Incidents</td><td data-label="HM Software LLC / Spala">Investigate product or Spala-controlled processing and notify as agreed</td><td data-label="Customer">Operate environment response and make controller/regulatory decisions</td></tr><tr><td data-label="Control area">Regions and transfers</td><td data-label="HM Software LLC / Spala">Disclose Spala-controlled processing and applicable providers</td><td data-label="Customer">Select deployment, administrator, database, storage, log, and backup regions</td></tr><tr><td data-label="Control area">Exit</td><td data-label="HM Software LLC / Spala">Provide agreed export, documentation, and deletion from Spala-controlled systems</td><td data-label="Customer">Preserve bundle/licence rights; export/delete customer-operated data and keys</td></tr></tbody></table></div>
+<h2>Fully isolated acceptance evidence</h2>
+<ul><li>Record bundle version, checksum, dependencies, and available SBOM.</li><li>Prove customer PostgreSQL and object storage work without Spala credentials.</li><li>Inventory outbound destinations and test with egress denied.</li><li>Confirm there is no mandatory Spala runtime API, authentication, telemetry, storage,</li></ul>
+<p>or licence-check dependency.</p>
+<ul><li>Prove archive, verification, reclamation, restore, export, and deletion paths.</li><li>Record approved regions, administrators, retention, patch, backup, and support policy.</li><li>Accept current assurance limits, including independent-audit and code-signing status.</li></ul>
+<p>Architecture review: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/dpa-sample.html

@@ -0,0 +1,30 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep Data Processing Agreement — public template — Sealkeep Trust Center</title><meta name="description" content="Inspect Data Processing Agreement for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/dpa-sample.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Data Processing Agreement</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html" aria-current="page">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status planned">Public template</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep Data Processing Agreement — public template</h1>
+<p class="document-meta"><strong>Status:</strong> Public template; internally approved by HM Software LLC<br><strong>Template reviewed:</strong> 2026-09-04<br><strong>Provider:</strong> HM Software LLC (Spala / Sealkeep), Wyoming entity 2023-001240874</p>
+<p>This template is available for pre-contract inspection and customer review. It is not legal advice, a certification, or a claim that one document alone establishes GDPR compliance. The signed DPA identifies the customer, selected deployment, applicable law, processing annexes, verified Subprocessors, retention terms, and transfer mechanism.</p>
+<h2>1. Roles and scope</h2>
+<p>Customer is the controller and HM Software LLC is the processor only to the extent HM Software LLC processes Customer Personal Data on Customer's behalf. In a fully self-hosted deployment, HM Software LLC does not become a processor of deployment data solely because its software runs in customer-controlled infrastructure.</p>
+<p>Customer Personal Data will be processed only to provide, secure, support, and terminate the selected service; on documented customer instructions; or as required by applicable law, with notice where legally permitted.</p>
+<p>Sealkeep will not sell Customer Personal Data, use it for behavioural advertising, or use plaintext coding-agent transcripts to train a general-purpose model. The hosted design is not intended to give Spala the keys needed to decrypt archives. Encrypted personal data is not described as anonymous merely because Spala lacks a decryption key.</p>
+<h2>2. Confidentiality and security</h2>
+<p>Authorised personnel and contractors must be subject to confidentiality obligations and limited to access needed to perform the agreement. Appropriate technical and organisational measures are described in the separately inspectable TOMs sample and completed for the selected deployment.</p>
+<p>For self-hosted operation, the customer is responsible for its runtime, network, PostgreSQL, object storage, identity, backups, monitoring, patch deployment, region, retention, and deletion controls.</p>
+<h2>3. Subprocessors</h2>
+<p>The customer provides general written authorisation for verified Subprocessors listed in the agreement's annex for the selected hosted service. Customer-selected and customer-contracted infrastructure is not appointed by HM Software LLC merely because Sealkeep interoperates with it.</p>
+<p>The intended change process provides at least 30 days' notice before a new applicable Subprocessor begins processing Customer Personal Data and allows an objection on reasonable data-protection grounds. Exact notice and remedy terms are finalised in the signed agreement.</p>
+<h2>4. Assistance and rights requests</h2>
+<p>Taking into account the nature of processing, HM Software LLC will reasonably assist the customer with rights requests, security obligations, breach assessments, DPIAs, and regulatory consultation.</p>
+<p>Spala cannot search inside or selectively alter archive content for which it has no decryption key. It can assist with account-linked metadata or deletion of identified ciphertext where the selected service exposes that capability. The customer retains its endpoint tools and keys for content search, export, correction at source, re-archival, and deletion.</p>
+<h2>5. Personal-data incidents</h2>
+<p>HM Software LLC will notify the affected customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include available facts about the event, affected data, likely consequences, mitigation, and a contact point. A numerical notification target applies only if it is separately agreed and operationally supported.</p>
+<h2>6. Return and deletion</h2>
+<p>On termination or valid instruction, HM Software LLC will return or delete Customer Personal Data under its control unless applicable law requires retention. Active system and backup-expiry periods must be stated in the signed order form. The public sample does not represent that an unverified backup-expiry schedule is automated.</p>
+<p>The customer controls deletion from its endpoints, PostgreSQL, object stores, logs, snapshots, and backups in self-hosted operation.</p>
+<h2>7. International transfers</h2>
+<p>Processing locations and applicable transfer safeguards must be completed from the verified Subprocessor register for the selected service. Where a restricted transfer requires Standard Contractual Clauses or another transfer mechanism, the signed DPA will incorporate the applicable terms before the transfer occurs.</p>
+<h2>8. Audit and information</h2>
+<p>HM Software LLC will provide information reasonably necessary to demonstrate the contracted processing obligations. Audit scope, confidentiality, frequency, cost, independent reports, remediation, and customer on-site rights are completed in the signed agreement. Internal tests are not represented as independent certification.</p>
+<h2>Annexes required for signature</h2>
+<ol><li>Parties, subject matter, duration, purposes, data categories, and data subjects.</li><li>Selected deployment and technical and organisational measures.</li><li>Verified Subprocessors, locations, and transfer safeguards.</li><li>Customer instructions, retention, deletion, support access, and contacts.</li></ol>
+<p>Legal review: <a href="mailto:legal@spala.ai">legal@spala.ai</a> Privacy review: <a href="mailto:privacy@spala.ai">privacy@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/release-provenance.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep release provenance and SBOM status — Sealkeep Trust Center</title><meta name="description" content="Inspect Release provenance &amp; SBOM for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/release-provenance.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Release provenance &amp; SBOM</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html" aria-current="page">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status draft">Partial today</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep release provenance and SBOM status</h1>
+<p class="document-meta"><strong>Status:</strong> Partial controls implemented; complete public per-release evidence planned<br><strong>Reviewed:</strong> 2026-09-04<br><strong>Current source package version:</strong> 0.10.0</p>
+<p>This page states the release evidence Sealkeep can show today and the controls it does not yet claim. It is not a software-signing or supply-chain certification.</p>
+<h2>Available today</h2>
+<ul><li><code>package-lock.json</code> records the resolved npm dependency graph and integrity fields.</li><li>The package declares supported runtime and platform constraints.</li><li>The build runs from TypeScript source and the release process can be tied to a named</li></ul>
+<p>source revision.</p>
+<ul><li>Release tooling computes a SHA-256 digest and byte size for a packed artifact.</li><li>Release tooling emits an explicitly unsigned manifest when no signing key is</li></ul>
+<p>supplied; it does not silently make an unsigned artifact appear signed.</p>
+<ul><li>When a deliberately supplied release key is available, the manifest format supports</li></ul>
+<p>an Ed25519 signature and key identifier.</p>
+<ul><li>Automated tests cover cryptographic tampering, restore integrity, queue durability,</li></ul>
+<p>upload verification, tenant boundaries, device auth, and company collaboration.</p>
+<h2>Evidence expected with an enterprise delivery</h2>
+<div class="table-scroll"><table><thead><tr><th>Evidence</th><th>Current status</th></tr></thead><tbody><tr><td data-label="Evidence">Product name, semantic version, build timestamp</td><td data-label="Current status">Available in package/build metadata</td></tr><tr><td data-label="Evidence">Source revision</td><td data-label="Current status">Record for the delivered build</td></tr><tr><td data-label="Evidence">Artifact filename, byte size, SHA-256</td><td data-label="Current status">Supported by release tooling</td></tr><tr><td data-label="Evidence">Dependency lockfile</td><td data-label="Current status">Available</td></tr><tr><td data-label="Evidence">Machine-readable SBOM (CycloneDX or SPDX)</td><td data-label="Current status">Planned for public per-release publication</td></tr><tr><td data-label="Evidence">Signed release manifest and published verification key</td><td data-label="Current status">Supported by tooling; public release operation and key policy remain to establish</td></tr><tr><td data-label="Evidence">OS code-signing/notarisation</td><td data-label="Current status">Not currently claimed</td></tr><tr><td data-label="Evidence">Reproducible-build proof</td><td data-label="Current status">Not currently claimed</td></tr><tr><td data-label="Evidence">Vulnerability scan summary and disposition</td><td data-label="Current status">Process and public artifact remain to establish</td></tr><tr><td data-label="Evidence">Build-system attestation (for example SLSA provenance)</td><td data-label="Current status">Not currently claimed</td></tr></tbody></table></div>
+<h2>Acceptance rule</h2>
+<p>A buyer should treat only the evidence supplied for the exact delivered artifact as release provenance. A source lockfile, test run, checksum, signed manifest, SBOM, OS signature, and independent assessment answer different questions and must not be presented as interchangeable.</p>
+<h2>Planned public release bundle</h2>
+<ol><li>Versioned artifact and SHA-256 checksums.</li><li>Source revision and build-environment identity.</li><li>CycloneDX or SPDX SBOM generated from the shipped dependency graph.</li><li>Signed manifest plus published verification procedure and key-rotation policy.</li><li>Test and vulnerability-scan summary with unresolved findings stated.</li><li>Platform signing/notarisation evidence when certificates are operational.</li></ol>
+<p>Supply-chain questions: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/subprocessors.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep Subprocessor Register — public verification view — Sealkeep Trust Center</title><meta name="description" content="Inspect Subprocessor register for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/subprocessors.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Subprocessor register</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html" aria-current="page">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status draft">Verification open</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep Subprocessor Register — public verification view</h1>
+<p class="document-meta"><strong>Status:</strong> Verification open; not yet an approved contractual register<br><strong>Reviewed:</strong> 2026-09-04<br><strong>Scope:</strong> Spala-selected hosted Sealkeep services only</p>
+<p>This view intentionally exposes the current verification gap. It must not be treated as a completed DPA annex until each provider's production use, legal entity, location, transfer mechanism, contract, and deletion terms are verified.</p>
+<div class="table-scroll"><table><thead><tr><th>Provider/service category</th><th>Intended purpose and data</th><th>Applies to</th><th>Current state</th></tr></thead><tbody><tr><td data-label="Provider/service category">Cloudflare / R2 and web delivery</td><td data-label="Intended purpose and data">Encrypted archive objects, object keys/checksums; web request metadata where enabled</td><td data-label="Applies to">Managed storage and public website</td><td data-label="Current state">Product and current operations identify these services; contracting entity, locations, transfer terms, and deletion evidence remain to verify</td></tr><tr><td data-label="Provider/service category">Google services</td><td data-label="Intended purpose and data">Optional Google sign-in; GCS migration fallback; optional customer-selected Google Drive is excluded when contracted directly by customer</td><td data-label="Applies to">Selected hosted features</td><td data-label="Current state">Implementation identifies these services; exact production scope, legal entity, access locations, and transfer terms remain to verify</td></tr><tr><td data-label="Provider/service category">Transactional email</td><td data-label="Intended purpose and data">Account verification and operational email: address, template content, delivery events</td><td data-label="Applies to">Hosted accounts</td><td data-label="Current state">Implementation references Postmark; production account and contracting entity remain to verify</td></tr><tr><td data-label="Provider/service category">Hosted application/database platform</td><td data-label="Intended purpose and data">Account, device, operational, billing, encrypted metadata, and request-log data</td><td data-label="Applies to">Hosted service</td><td data-label="Current state">Production infrastructure provider and locations remain to verify</td></tr><tr><td data-label="Provider/service category">Payment provider</td><td data-label="Intended purpose and data">Subscription, invoice, tax, and payment administration; Sealkeep should not receive full card data</td><td data-label="Applies to">Paid hosted service</td><td data-label="Current state">Add only after production billing configuration is verified</td></tr><tr><td data-label="Provider/service category">External support system</td><td data-label="Intended purpose and data">Contact details, cases, attachments, and customer-supplied diagnostics</td><td data-label="Applies to">Support, if externally operated</td><td data-label="Current state">Add only if support is not handled solely in Spala-controlled systems</td></tr><tr><td data-label="Provider/service category">Monitoring/error service</td><td data-label="Intended purpose and data">Request metadata, pseudonymous identifiers, and diagnostics; no transcript plaintext by design</td><td data-label="Applies to">Hosted service, if enabled</td><td data-label="Current state">Add only after production configuration is verified</td></tr></tbody></table></div>
+<h2>Not Spala Subprocessors in fully self-hosted operation</h2>
+<p>A provider selected, contracted, and controlled directly by the customer is not appointed by Spala merely because Sealkeep interoperates with it. This commonly includes the customer's:</p>
+<ul><li>PostgreSQL, Kubernetes, virtual-machine, container, and network providers;</li><li>S3, R2, GCS, Backblaze B2, Google Drive, MinIO, or compatible object storage;</li><li>identity, logging, monitoring, backup, email, and support systems;</li><li>coding-agent vendors whose local files the customer elects to archive.</li></ul>
+<p>If Spala selects, contracts, or can instruct a provider on the customer's behalf, its role must be reassessed and the applicable register updated.</p>
+<h2>Change process proposed for the signed DPA</h2>
+<ol><li>Review a provider before it receives production Customer Personal Data.</li><li>Record entity, purpose, data, locations, retention, security, onward processors,</li></ol>
+<p>and transfer mechanism.</p>
+<ol><li>Execute applicable Article 28 flow-down terms before production use.</li><li>Provide at least 30 days' notice before adding an applicable Subprocessor.</li><li>Accept reasonable data-protection objections within the agreed review window.</li><li>Date the register when a provider begins or ends production use.</li></ol>
+<p>Verification and objections: <a href="mailto:privacy@spala.ai">privacy@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/threat-model.html

@@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep threat model — public summary — Sealkeep Trust Center</title><meta name="description" content="Inspect Threat model for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/threat-model.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Threat model</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html" aria-current="page">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status draft">Unaudited</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep threat model — public summary</h1>
+<p class="document-meta"><strong>Status:</strong> Implementer-authored; not independently audited<br><strong>Reviewed:</strong> 2026-09-04<br><strong>Scope:</strong> Archive format v2, endpoint client, storage path, and local model interface</p>
+<h2>Assets</h2>
+<p>Coding-agent transcripts may contain prompts, source code, commands, credentials, business context, and personal data. The primary assets are session plaintext and the recovery phrase or device private keys that can open an archive.</p>
+<h2>Trust assumptions</h2>
+<div class="table-scroll"><table><thead><tr><th>Party</th><th>Trusted for</th><th>Not trusted for</th></tr></thead><tbody><tr><td data-label="Party">Local client process</td><td data-label="Trusted for">Plaintext handling, encryption, key generation</td><td data-label="Not trusted for">—</td></tr><tr><td data-label="Party">Local OS account</td><td data-label="Trusted for">Reading its own agent files</td><td data-label="Not trusted for">Protection after account compromise</td></tr><tr><td data-label="Party">Control plane</td><td data-label="Trusted for">Availability, identity, membership, operational metadata</td><td data-label="Not trusted for">Transcript confidentiality</td></tr><tr><td data-label="Party">Object storage</td><td data-label="Trusted for">Durability</td><td data-label="Not trusted for">Confidentiality or authenticity</td></tr><tr><td data-label="Party">Network</td><td data-label="Trusted for">Nothing</td><td data-label="Not trusted for">Confidentiality, integrity, availability</td></tr><tr><td data-label="Party">Local MCP client/model</td><td data-label="Trusted for">Requesting authorised tools</td><td data-label="Not trusted for">Treating recalled historical text as trusted instructions</td></tr></tbody></table></div>
+<h2>Principal adversaries and controls</h2>
+<h3>Breached control plane</h3>
+<p>The service can see account/device identifiers, archive identifiers, size, timestamps, checksums, object routes, and encrypted manifests needed for operation. It is not designed to receive archive keys, recovery phrases, device private keys, or session plaintext. It can deny service or lie about metadata, so clients verify downloaded objects and refuse reclamation on failed durability checks.</p>
+<h3>Stolen archive object</h3>
+<p>An object contains authenticated ciphertext under a fresh per-archive 256-bit key. Opening it requires an authorised recipient secret or compromise of the published cryptographic primitive. Object size and chunk count remain visible.</p>
+<h3>Archive tampering</h3>
+<p>Authenticated data binds format version, suite, archive identity, chunk position, total count, plaintext length, and finality. Tests cover bit flips, reordering, truncation, cross-archive splicing, suite downgrade, and rewritten cheap hashes.</p>
+<h3>Compromised endpoint or OS user</h3>
+<p>An attacker running as the developer can already read the original agent session. Endpoint compromise is therefore outside the archive's confidentiality boundary. Sealkeep avoids ordinary config storage for phrases and private keys, applies owner-only local permissions, and excludes secrets from normal logs. OS keystore access by processes running as the logged-in user remains a stated trade-off.</p>
+<h3>Lost or stolen device</h3>
+<p>Devices are separate X25519 recipients. Service revocation blocks future operations; recipient removal and key rewrapping remove future archive access. Revocation cannot withdraw ciphertext and key material an attacker copied beforehand.</p>
+<h3>Replayed transfer capability</h3>
+<p>Transfer leases are short-lived, single-object capabilities. Expiry is checked and object routes are server-selected. A stolen upload capability cannot be used to read another archive or freely choose a storage key.</p>
+<h3>Malicious recalled context or model request</h3>
+<p>The MCP service is local but model-driven. Search is bounded, recovered historical text is labelled untrusted, destructive actions require explicit authority, and native restore is constrained to supported transcript roots.</p>
+<h2>Cryptographic construction</h2>
+<ul><li>ChaCha20-Poly1305 by default or AES-256-GCM through Node/OpenSSL.</li><li>Fresh random 32-byte key per archive.</li><li>Per-archive random nonce prefix plus a 64-bit chunk counter.</li><li>scrypt-derived phrase wrapping; X25519 and HKDF-SHA256 device wrapping.</li><li>Per-chunk authenticated tags and hashes plus a whole-plaintext digest on restore.</li></ul>
+<p>No custom encryption primitive is claimed.</p>
+<h2>Known limitations</h2>
+<ol><li>Ciphertext length and timing reveal operational information; no padding is applied.</li><li>Source path and selected metadata may exist in cleartext in the local vault record.</li><li>A compromised recovery phrase can open every archive for which it remains a recipient.</li><li>JavaScript memory zeroisation is best effort.</li><li>Recorded scrypt parameters balance current endpoint responsiveness and can be raised</li></ol>
+<p>for new archives without changing old ones.</p>
+<ol><li>Device revocation is not retroactive for copies already obtained.</li><li>Current Team continuity depends on remaining accepted project members; there is no</li></ol>
+<p>claimed separate organisation recovery recipient or transferable owner today.</p>
+<h2>Open independent-assurance gates</h2>
+<ul><li>Independent third-party review of the archive format and implementation.</li><li>External review of the key and organisation-recovery lifecycle.</li><li>Public package/test-vector publication for the reviewed release.</li><li>Independent application penetration test and remediation summary.</li></ul>
+<p>Security reports: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust/toms.html

@@ -0,0 +1,41 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sealkeep technical and organisational measures — inspectable sample — Sealkeep Trust Center</title><meta name="description" content="Inspect Technical &amp; organisational measures for Sealkeep enterprise security and procurement review."><link rel="canonical" href="https://sealkeep.spala.ai/trust/toms.html"><link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='5' fill='%2308100b'/%3E%3Cpath d='M8 8h16v16H8z' fill='none' stroke='%23e0a52c' stroke-width='3'/%3E%3C/svg%3E"><link rel="stylesheet" href="/trust-document.css"></head>
+<body><nav class="topbar"><div class="topbar-inner"><a class="logo" href="/">⌑ Sealkeep</a><div class="crumb"><a href="/trust.html">Trust Center</a><span>/</span><b>Technical &amp; organisational measures</b></div><button class="print" type="button" onclick="window.print()">Print / Save PDF</button></div></nav><main class="doc-shell"><div class="doc-mobile"><a class="enterprise-back" href="/#enterprise">← Enterprise</a><details class="doc-switcher"><summary>Explore documents</summary><nav aria-label="Trust documents"><a href="/trust/architecture-data-flow.html">Architecture &amp; data flow</a><a href="/trust/dpa-sample.html">Data Processing Agreement</a><a href="/trust/toms.html" aria-current="page">Technical &amp; organisational measures</a><a href="/trust/subprocessors.html">Subprocessor register</a><a href="/trust/deployment-responsibility.html">Deployment responsibility matrix</a><a href="/trust/release-provenance.html">Release provenance &amp; SBOM</a><a href="/trust/threat-model.html">Threat model</a><a href="/trust/audit-roadmap.html">Audit roadmap</a></nav></details></div><aside class="doc-nav"><a class="back" href="/trust.html">← Evidence index</a><a href="/trust/architecture-data-flow.html"><span>Architecture &amp; data flow</span><small>Published</small></a><a href="/trust/dpa-sample.html"><span>Data Processing Agreement</span><small>Public template</small></a><a href="/trust/toms.html"><span>Technical &amp; organisational measures</span><small>Control statement</small></a><a href="/trust/subprocessors.html"><span>Subprocessor register</span><small>Verification open</small></a><a href="/trust/deployment-responsibility.html"><span>Deployment responsibility matrix</span><small>Published</small></a><a href="/trust/release-provenance.html"><span>Release provenance &amp; SBOM</span><small>Partial today</small></a><a href="/trust/threat-model.html"><span>Threat model</span><small>Unaudited</small></a><a href="/trust/audit-roadmap.html"><span>Audit roadmap</span><small>Roadmap</small></a></aside><article class="document"><header class="document-head"><span class="status planned">Control statement</span><p>Public procurement evidence · reviewed 4 September 2026</p></header><h1>Sealkeep technical and organisational measures — inspectable sample</h1>
+<p class="document-meta"><strong>Status:</strong> Public control statement; scope completed for the selected deployment<br><strong>Reviewed:</strong> 2026-09-04</p>
+<p>This statement supports security review. It is not an independent certification. The applicable scope and customer-operated responsibilities are completed for the selected hosted or self-hosted deployment when incorporated into an agreement.</p>
+<h2>Implemented product controls</h2>
+<h3>Data minimisation and cryptography</h3>
+<ul><li>Coding-agent session content is encrypted on the endpoint before upload.</li><li>Each archive receives a random data-encryption key, wrapped locally for configured</li></ul>
+<p>phrase and device recipients.</p>
+<ul><li>ChaCha20-Poly1305 or AES-256-GCM provides authenticated encryption through the</li></ul>
+<p>Node/OpenSSL implementation.</p>
+<ul><li>Chunk metadata binds archive identity, suite, order, count, length, and finality.</li><li>Recovery phrases, device private keys, plaintext archive keys, plaintext session</li></ul>
+<p>content, and customer storage credentials are not designed to enter hosted logs or configuration.</p>
+<ul><li>Local HTTP APIs bind to loopback, require a local token for state, and do not expose</li></ul>
+<p>a decryption endpoint.</p>
+<h3>Access and tenant boundaries</h3>
+<ul><li>Devices use separate public/private key identities; the private key stays local.</li><li>Control-plane device requests use signatures, timestamps, and replay-resistant</li></ul>
+<p>nonces in the documented self-hosted interface.</p>
+<ul><li>Hosted records are scoped to the authenticated account or project.</li><li>Destructive archive operations require separate authority and produce audit events.</li><li>Team access uses project membership and keys wrapped for authorised members.</li><li>Recalled historical text is treated as untrusted input.</li></ul>
+<h3>Durability and recovery</h3>
+<ul><li>A local source is not eligible for reclamation until a remote encrypted copy has</li></ul>
+<p>been verified.</p>
+<ul><li>Ordinary reclamation stages the local source through a recoverable boundary rather</li></ul>
+<p>than silently treating upload initiation as durability.</p>
+<ul><li>Restore verifies authenticated chunks and the whole-plaintext digest.</li><li>Loss of all recovery recipients is not support-recoverable by design.</li></ul>
+<h3>Secure development evidence</h3>
+<ul><li>Type checking and automated tests cover crypto tampering, restoration, queue crash</li></ul>
+<p>recovery, upload verification, signed requests, tenant boundaries, and team flows.</p>
+<ul><li>The repository contains deterministic cryptographic vectors, provider emulators,</li></ul>
+<p>acceptance scenarios, and live company-flow rehearsal records.</p>
+<ul><li>Dependency versions are recorded in a lockfile.</li><li>Release tooling can create SHA-256 manifests and supports signing when the release</li></ul>
+<p>key is deliberately supplied.</p>
+<h2>Operational measures requiring deployment evidence</h2>
+<p>The following must be verified for the actual production service or supplied by the customer in a self-hosted deployment:</p>
+<ul><li>named administrative identities, MFA, least privilege, and periodic access review;</li><li>network ingress and database exposure configuration;</li><li>secret-management and rotation process;</li><li>production change approval, rollback, and vulnerability-remediation targets;</li><li>log access controls, retention, alerts, and on-call routing;</li><li>backup frequency, RPO/RTO, region, expiry, and restore-test record;</li><li>personnel security training and joiner/mover/leaver evidence;</li><li>incident exercise record and customer-notification operation;</li><li>production retention and deletion evidence;</li><li>verified Subprocessor contracts, locations, and transfer safeguards.</li></ul>
+<p>These are intentionally not marked complete merely because corresponding application code or a written policy exists.</p>
+<h2>Customer-operated controls in fully isolated deployment</h2>
+<p>The customer operates runtime infrastructure, network, PostgreSQL, object storage, TLS, identity, administrator access, secrets, monitoring, backups, disaster recovery, regions, patch timing, endpoint custody, retention, and deletion. Spala has no standing administrator access. Customer-approved support access must be time-bounded, least-privileged, attributable, and revocable.</p>
+<h2>Assurance boundary</h2>
+<ul><li>No completed independent cryptographic audit is claimed.</li><li>No SOC 2 or ISO 27001 certification is claimed.</li><li>JavaScript zeroisation is best effort.</li><li>Ciphertext length and timing reveal operational information.</li><li>Release manifests do not equal an OS code-signing certificate.</li></ul>
+<p>Security questions: <a href="mailto:security@spala.ai">security@spala.ai</a></p><footer class="document-foot"><p>Sealkeep is a product of HM Software LLC, the company behind Spala AI.</p><nav aria-label="Company"><a href="https://spala.ai/about/">About the company</a> &middot; <a href="https://spala.ai/terms/">Company terms</a> &middot; <a href="https://spala.ai/privacy/">Company privacy policy</a></nav><p>This public sample supports review. The signed agreement and customer-selected deployment remain authoritative.</p><a href="mailto:security@spala.ai?subject=Sealkeep%20security%20review">Ask a security question →</a></footer></article></main></body></html>

package/dist/site/trust-document.css

@@ -0,0 +1,32 @@
+:root{color-scheme:dark;--bg:#08100b;--band:#0d1710;--surface:#111d14;--rule:#35432f;--soft-rule:#223025;--ink:#f4eee3;--soft:#aab3aa;--sage:#a9c779;--amber:#e0a52c;--cyan:#78d9ed;--rust:#d18768;--sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;--mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace}
+*{box-sizing:border-box}html{scroll-behavior:smooth}body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--sans);line-height:1.65}a{color:inherit}.topbar{position:sticky;top:0;z-index:20;border-bottom:1px solid var(--soft-rule);background:rgb(8 16 11/94%);backdrop-filter:blur(14px)}.topbar-inner{width:min(1380px,calc(100% - 40px));min-height:60px;margin-inline:auto;display:flex;align-items:center;gap:24px}.logo{flex:none;font:800 .78rem var(--mono);letter-spacing:.15em;text-decoration:none;text-transform:uppercase}.logo::after{content:" .";color:var(--amber)}.crumb{min-width:0;display:flex;align-items:center;gap:10px;color:var(--soft);font:700 .62rem var(--mono);letter-spacing:.07em;text-transform:uppercase}.crumb a{text-decoration:none}.crumb a:hover{color:var(--ink)}.crumb b{min-width:0;overflow:hidden;color:var(--sage);font-weight:700;text-overflow:ellipsis;white-space:nowrap}.print{margin-left:auto;padding:9px 12px;border:1px solid var(--rule);background:var(--surface);color:var(--ink);font:700 .6rem var(--mono);letter-spacing:.08em;text-transform:uppercase;cursor:pointer}.print:hover{border-color:var(--amber);color:var(--amber)}
+.doc-shell{width:min(1380px,calc(100% - 40px));margin-inline:auto;display:grid;grid-template-columns:250px minmax(0,820px);gap:clamp(48px,8vw,112px);align-items:start}.doc-nav{position:sticky;top:92px;padding:48px 0 80px}.doc-nav>a{display:flex;align-items:start;justify-content:space-between;gap:14px;padding:13px 0;border-bottom:1px solid var(--soft-rule);color:var(--soft);font-size:.76rem;line-height:1.35;text-decoration:none}.doc-nav>a:hover{color:var(--ink)}.doc-nav>a:first-child{padding-top:0;color:var(--cyan);font:700 .61rem var(--mono);letter-spacing:.08em;text-transform:uppercase}.doc-nav span{max-width:155px}.doc-nav small{color:#6f7b71;font:700 .52rem var(--mono);letter-spacing:.05em;text-align:right;text-transform:uppercase}
+.document{min-width:0;padding:68px 0 110px}.document-head{display:flex;align-items:center;gap:18px;margin-bottom:44px;padding-bottom:22px;border-bottom:1px solid var(--rule)}.document-head p{margin:0;color:#788279;font:700 .58rem var(--mono);letter-spacing:.08em;text-transform:uppercase}.status{display:inline-flex;align-items:center;gap:8px;padding:7px 10px;border:1px solid var(--rule);color:var(--soft);font:700 .58rem var(--mono);letter-spacing:.08em;text-transform:uppercase}.status::before{content:"";width:7px;height:7px;border-radius:50%;background:var(--sage)}.status.draft::before{background:var(--amber)}.status.planned::before{background:var(--rust)}
+.document h1{max-width:13ch;margin:0 0 26px;font-size:clamp(2.8rem,6vw,5.7rem);line-height:.91;letter-spacing:-.058em}.document h2{margin:68px 0 20px;padding-top:22px;border-top:1px solid var(--rule);font-size:clamp(1.65rem,3.5vw,2.65rem);line-height:1.05;letter-spacing:-.04em}.document h3{margin:38px 0 12px;color:var(--sage);font-size:1.08rem;letter-spacing:-.015em}.document p{max-width:72ch;margin:0 0 22px;color:#c6cec5;font-size:.98rem}.document-meta{margin:0 0 42px!important;padding:20px 22px;border:1px solid var(--rule);background:var(--surface);color:var(--soft)!important;font:600 .73rem/1.8 var(--mono)!important}.document-meta strong{color:var(--sage)}.document strong{color:var(--ink)}.document a{color:var(--cyan);text-underline-offset:3px}.document code{padding:.12em .36em;border:1px solid var(--rule);background:var(--surface);color:var(--sage);font:600 .84em var(--mono)}.document ul,.document ol{max-width:70ch;margin:0 0 26px;padding-left:22px;color:#c6cec5}.document li{padding-left:5px}.document li+li{margin-top:9px}.document li::marker{color:var(--amber)}
+pre{position:relative;max-width:100%;margin:28px 0;padding:24px;overflow:auto;border:1px solid var(--rule);background:#050906;color:#dce4da;font:500 .78rem/1.75 var(--mono);tab-size:2}pre::before{content:attr(data-language);display:block;margin-bottom:18px;color:var(--amber);font:700 .56rem var(--mono);letter-spacing:.1em;text-transform:uppercase}pre code{padding:0;border:0;background:none;color:inherit;font:inherit}.table-scroll{max-width:100%;margin:28px 0;overflow:auto;border:1px solid var(--rule)}table{width:100%;border-collapse:collapse;background:var(--surface)}th,td{padding:14px 15px;border-right:1px solid var(--rule);border-bottom:1px solid var(--rule);vertical-align:top;text-align:left;font-size:.79rem;line-height:1.55}th:last-child,td:last-child{border-right:0}tbody tr:last-child td{border-bottom:0}th{background:var(--band);color:var(--sage);font:700 .59rem var(--mono);letter-spacing:.075em;text-transform:uppercase}td{color:#d2d9d1}.document-foot{display:grid;grid-template-columns:1fr auto;gap:28px;align-items:center;margin-top:74px;padding:24px 0;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule)}.document-foot p{margin:0;color:var(--soft);font-size:.8rem}.document-foot a{font:800 .63rem var(--mono);letter-spacing:.08em;text-decoration:none;text-transform:uppercase;white-space:nowrap}
+@media(max-width:900px){.doc-shell{grid-template-columns:1fr}.doc-nav{position:static;display:flex;gap:18px;padding:26px 0 0;overflow:auto;border-bottom:1px solid var(--rule)}.doc-nav>a{flex:0 0 auto;border:0}.doc-nav>a:not(.back){display:none}.document{padding-top:42px}.crumb b{display:none}}
+@media(max-width:620px){.topbar-inner,.doc-shell{width:calc(100% - 28px)}.topbar-inner{gap:12px}.crumb{display:none}.print{font-size:.54rem}.document{padding-bottom:72px}.document-head{display:block;margin-bottom:34px}.document-head p{margin-top:12px}.document h1{font-size:clamp(2.55rem,14vw,4.2rem)}.document h2{margin-top:54px}.document-meta{padding:17px;font-size:.66rem!important}pre{white-space:pre-wrap;overflow-wrap:anywhere;word-break:break-word}.table-scroll{overflow:visible;border:0}table,tbody,tr,td{display:block;width:100%}thead{display:none}tr{margin-top:12px;border:1px solid var(--rule);background:var(--surface)}tr:first-child{margin-top:0}td,td:last-child{padding:11px 13px;border:0;border-bottom:1px solid var(--soft-rule);font-size:.78rem}tr td:last-child{border-bottom:0}td::before{content:attr(data-label);display:block;margin-bottom:4px;color:var(--sage);font:700 .54rem var(--mono);letter-spacing:.08em;text-transform:uppercase}.document-foot{grid-template-columns:1fr}.document-foot a{white-space:normal}}
+.topbar-inner,.doc-shell{width:min(1232px,calc(100% - 48px))}
+.topbar .logo,.crumb a,.print{display:inline-flex;align-items:center;min-height:44px}
+.print{font-size:.7rem}.crumb{font-size:.75rem;letter-spacing:0}
+.doc-nav>a{min-height:44px;font-size:.875rem;line-height:1.45}
+.doc-nav small{font-size:.625rem}
+.doc-nav>a:first-child{padding-block:13px;font-size:.75rem}
+.document-foot a{display:inline-flex;align-items:center;min-height:44px;font-size:.75rem}
+.doc-mobile{display:none}
+:focus-visible{outline:2px solid var(--amber);outline-offset:4px}
+@media(max-width:900px){
+  .doc-shell{gap:0}
+  .doc-mobile{display:flex;gap:16px;align-items:start;padding-top:16px;position:relative;z-index:5}
+  .enterprise-back{display:inline-flex;align-items:center;min-height:44px;font-size:.875rem;white-space:nowrap;text-underline-offset:4px}
+  .doc-switcher{position:relative;margin-left:auto;font-size:.875rem}
+  .doc-switcher summary{padding:11px 14px;border:1px solid var(--rule);background:var(--surface);cursor:pointer;min-height:44px}
+  .doc-switcher nav{position:absolute;right:0;top:100%;width:min(320px,calc(100vw - 32px));padding:8px;border:1px solid var(--rule);background:var(--surface);box-shadow:0 14px 36px #0006}
+  .doc-switcher a{display:block;padding:12px;line-height:1.45;min-height:44px;text-decoration:none}
+  .doc-switcher a:hover,.doc-switcher a[aria-current]{background:var(--band);color:var(--sage)}
+  .doc-nav{display:none}
+  .document{padding-top:32px}
+}
+@media(max-width:620px){.topbar-inner,.doc-shell{width:calc(100% - 32px)}.print{font-size:.625rem}.document-head{margin-bottom:28px}.document h1{font-size:clamp(2.3rem,10vw,3.5rem);line-height:1.04}}
+@media(prefers-reduced-motion:reduce){html{scroll-behavior:auto}}
+@media print{body{background:#fff;color:#111}.topbar,.doc-nav,.doc-mobile,.document-foot{display:none}.doc-shell{display:block;width:100%}.document{padding:0}.document h1,.document h2,.document h3,.document strong{color:#111}.document p,.document li,.document td{color:#333}.document-meta,table,pre{background:#fff;color:#111;border-color:#bbb}.document a{color:#111;text-decoration:none}}